CVE-2026-56451
CVSS 10 CRITICAL: a vulnerability has been identified in Opcenter X (All versions < V2604). EPSS 0.5% (40th percentile).
Vulnerabilities & Exploits
Opcenter X below V2604 treats a forged JWT as a real login, so an attacker can step into any user’s session, including admin. The broken check is in the token’s algorithm validation, which means standard access controls fall away once the app accepts the token.
CISA and Siemens have published CVE-2026-56451 for Siemens Opcenter X < V2604. Siemens says V2604 fixes the issue, and the flaw affects Opcenter X deployments in critical manufacturing environments.
1 source · Jul 21
CVSS 10 CRITICAL: a vulnerability has been identified in Opcenter X (All versions < V2604). EPSS 0.5% (40th percentile).
CISA Advisories
Siemens Opcenter X | CISA
Siemens Opcenter X Summary Opcenter X before V2604 contain an authentication bypass vulnerability that could allow an attacker to gain full unauthorized access to the application.
originalPart of the PlainSec briefing for 2026-07-21
Every edition of this story: Forged JWTs can impersonate Opcenter X admins